StackRadar

CVE-2026-97688

Medium

Advisory

Published 29 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
577
of 17,966 indexed, latest versions
Container images
435
deployed by those charts
Fix available
1 of 3
affected packages

urllib3: Chunked Deflate streaming can enter an infinite loop

Carried by container images the latest versions of 577 of 17,966 indexed charts deploy, on 435 images.

Affected packageAffected versionsFixed inImages
urllib3pypi2.6.2, 2.6.3, 2.7.02.8.0298
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+23 moreno fix listed114
python-urllib3deb1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+12 moreno fix listed62
OSV records
GHSA-gh4c-6fx4-qh6gUBUNTU-CVE-2026-97688

Charts affected

577 by stars
ChartLatestAffected imagesRadar Score
pagescarmel-pages-dell1.0.01 of 3See more

pages carmel-pages-dell 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
castai-hibernatecastaiVerified publisher0.2.121 of 1See more

castai-hibernate castai 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
castai/hibernate:v0.14da62858c8381
urllib3@2.6.3
2.8.0

Open the chart page →

1,481
catalyst-agentscatalyst-agents0.1.341 of 18See more

catalyst-agents catalyst-agents 0.1.34

1 of the 18 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:2.10.17eac5c4fed71
urllib3@2.7.0
2.8.0

Open the chart page →

18,379
kube-ceemsceemsOfficialVerified publisher1.43.01 of 5See more

kube-ceems ceems 1.43.0

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
urllib3@2.7.0
2.8.0

Open the chart page →

602
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-web:3.0.06961eab190a2
urllib3@2.7.0
2.8.0

Open the chart page →

16,932
chart-appchart-app0.3.01 of 2See more

chart-app chart-app 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:80744ee5ef89c
urllib3@2.6.3
2.8.0

Open the chart page →

2,277
chart-dnazarenochart-dnazareno0.1.01 of 3See more

chart-dnazareno chart-dnazareno 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:80744ee5ef89c
urllib3@2.6.3
2.8.0

Open the chart page →

6,216
kitchenowlchart-kitchenowl0.1.131 of 2See more

kitchenowl chart-kitchenowl 0.1.13

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
urllib3@2.7.0
2.8.0

Open the chart page →

2,983
paperless-ngxcharts-derwitt-devVerified publisher2.1.51 of 1See more

paperless-ngx charts-derwitt-dev 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
urllib3@2.7.0
2.8.0

Open the chart page →

4,533
radicalecharts-derwitt-devVerified publisher0.1.0-1.0.01 of 1See more

radicale charts-derwitt-dev 0.1.0-1.0.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/kozea/radicale:3.7.600a3d8e1f04b
urllib3@2.7.0
2.8.0

Open the chart page →

487
sippchetan-opensips0.1.01 of 1See more

sipp chetan-opensips 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
chetangautamm/repo:sipp.v3e7f7049e1544
python-urllib3@1.25.8-2ubuntu0.1
no fix listed

Open the chart page →

92,876
prometheus-pve-exporterchristianhuthVerified publisher2.10.01 of 1See more

prometheus-pve-exporter christianhuth 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
prompve/prometheus-pve-exporter:3.10.04867684c0a93
urllib3@2.7.0
2.8.0

Open the chart page →

424
kube-acp-stackcloudentity2.29.01 of 7See more

kube-acp-stack cloudentity 2.29.0

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
python-pip@22.0.2+dfsg-1ubuntu0.5
python-urllib3@1.26.5-1~exp1ubuntu0.2
no fix listed
no fix listed

Open the chart page →

22,097
webpagetest-agentcloudnativeapp0.2.01 of 1See more

webpagetest-agent cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

138,319
cloudlaunchcloudve0.6.01 of 5See more

cloudlaunch cloudve 0.6.0

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

13,032
cloudlaunch-servercloudve0.2.01 of 5See more

cloudlaunch-server cloudve 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

12,646
cloudlaunchservercloudve0.6.01 of 4See more

cloudlaunchserver cloudve 0.6.0

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

12,167
galaxycloudve6.8.81 of 3See more

galaxy cloudve 6.8.8

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
urllib3@2.7.0
2.8.0

Open the chart page →

6,130
galaxykubemancloudve2.10.11 of 7See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

16,723
galaxy-stablecloudve2.0.02 of 5See more

galaxy-stable cloudve 2.0.0

2 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
python-pip@1.5.4-1ubuntu4
python-urllib3@1.7.1-1ubuntu4
no fix listed
no fix listed
galaxy/galaxy-stable:v18.018e577a626dfd
python-pip@1.5.4-1ubuntu4
python-urllib3@1.7.1-1ubuntu4
no fix listed
no fix listed

Open the chart page →

171,176
janisterminalcloudve0.1.01 of 2See more

janisterminal cloudve 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
cloudve/janis-terminal:latestaf56e77ca587
python-pip@9.0.1-2.3~ubuntu1.18.04.1
no fix listed

Open the chart page →

81,781
argo-cdcluster-deploy0.3.21 of 3See more

argo-cd cluster-deploy 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
urllib3@2.6.3
2.8.0

Open the chart page →

4,286
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
urllib3@2.6.3
2.8.0

Open the chart page →

3,016
monitoringcluster-deploy0.3.01 of 11See more

monitoring cluster-deploy 0.3.0

1 of the 11 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
urllib3@2.6.3
2.8.0

Open the chart page →

8,441
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
urllib3@2.6.3
2.8.0

Open the chart page →

7,723
gitea-jenkinsclusterfactory0.1.11 of 5See more

gitea-jenkins clusterfactory 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
urllib3@2.6.3
2.8.0

Open the chart page →

7,497
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
python-pip@24.0+dfsg-1ubuntu1.3
urllib3@2.7.0
no fix listed
2.8.0

Open the chart page →

14,451
loki-stackcommon-chartsVerified publisher1.0.32 of 12See more

loki-stack common-charts 1.0.3

2 of the 12 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.10.021b9fe7bb29d
urllib3@2.7.0
2.8.0
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
urllib3@2.6.3
2.8.0

Open the chart page →

5,923
pagescrypticcode-helmchart1.0.01 of 3See more

pages crypticcode-helmchart 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
csghubcsghubVerified publisher2.5.01 of 34See more

csghub csghub 2.5.0

1 of the 34 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
opencsghq/csgbot:v0.6.9-ee7d0271e26521
urllib3@2.6.3
2.8.0

Open the chart page →

53,831
pagesdalston-pages1.0.01 of 3See more

pages dalston-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagesdaman-dell-kuber1.0.01 of 3See more

pages daman-dell-kuber 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
urllib3@2.6.3
2.8.0

Open the chart page →

23,711
dask-gatewaydask2026.3.01 of 2See more

dask-gateway dask 2026.3.0

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-gateway-server:2026.3.0afa5a729114e
urllib3@2.6.3
2.8.0

Open the chart page →

2,360
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
urllib3@2.6.3
2.8.0

Open the chart page →

5,650
datacubedatacube-charts0.18.21 of 1See more

datacube datacube-charts 0.18.2

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
opendatacube/wms:latest1b90cdf68831
python-pip@9.0.1-2.3~ubuntu1
python-urllib3@1.22-1ubuntu0.18.04.1
no fix listed
no fix listed

Open the chart page →

98,966
datacube-datadatacube-charts0.2.61 of 1See more

datacube-data datacube-charts 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
geoscienceaustralia/dea-k8s-data:latestf4039b45572a
python-pip@9.0.1-2.3~ubuntu1.18.04.2
no fix listed

Open the chart page →

85,978
datacube-owsdatacube-charts0.20.31 of 1See more

datacube-ows datacube-charts 0.20.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/opendatacube/ows:latestf591c9d96c0f
urllib3@2.7.0
2.8.0

Open the chart page →

3,051
datacube-processingdatacube-charts0.1.11 of 2See more

datacube-processing datacube-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
opendatacube/pipelines:wofs-1.225d810e8504b8
python-pip@9.0.1-2.3~ubuntu1
no fix listed

Open the chart page →

93,704
restcubedatacube-charts0.2.91 of 1See more

restcube datacube-charts 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
opendatacube/restcube:latest91870111837c
python-pip@9.0.1-2.3~ubuntu1
python-urllib3@1.22-1ubuntu0.18.04.1
no fix listed
no fix listed

Open the chart page →

95,503
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
datagrok/grok_spawner:latest8c2d48c1545c
urllib3@2.7.0
2.8.0

Open the chart page →

2,641
pagesdavid-pages1.0.01 of 3See more

pages david-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagesdebasish-pages1.0.01 of 3See more

pages debasish-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
decisionrules/ai-engine:latest557dea1373aa
urllib3@2.7.0
2.8.0

Open the chart page →

2,136
intel-gpu-exporterdefault-ghVerified publisher0.1.01 of 1See more

intel-gpu-exporter default-gh 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
andrewgolikov55/intel-gpu-exporter:latestfcc001b61c0e
python-pip@22.0.2+dfsg-1ubuntu0.3
no fix listed

Open the chart page →

5,270
isponsorblocktvdefault-ghVerified publisher1.0.51 of 1See more

isponsorblocktv default-gh 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/dmunozv04/isponsorblocktv:v2.9.05b8cfa805cb6
urllib3@2.7.0
2.8.0

Open the chart page →

862
supersetdeliveryheroVerified publisher1.1.31 of 1See more

superset deliveryhero 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
urllib3@2.6.3
2.8.0

Open the chart page →

2,635
deployhubdeployhubVerified publisher10.0.4157 of 11See more

deployhub deployhub 10.0.415

7 of the 11 container images this version deploys carry CVE-2026-97688.

Open the chart page →

12,460
seafilederp3.2.01 of 1See more

seafile derp 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:10.0.170628f29c663
python-pip@20.0.2-5ubuntu1.9
python-urllib3@1.25.8-2ubuntu0.2
no fix listed
no fix listed

Open the chart page →

78,570
mysqldev-krishan-dhaka-charts1.0.11 of 1See more

mysql dev-krishan-dhaka-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.40744ee5ef89c
urllib3@2.6.3
2.8.0

Open the chart page →

511

Container images carrying it

435 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/vinny1892/octantis:latest45459c0910fc
urllib3@2.6.3
2.8.0
1
ghcr.io/zazukoians/qlever-server:v0.10.11de7869ab46e
python-pip@24.0+dfsg-1ubuntu1.3
urllib3@2.7.0
no fix listed
2.8.0
1
ghcr.io/zazukoians/qlever-ui:v0.10.151a7ec1c2de4
urllib3@2.6.3
2.8.0
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest573542399fe4
urllib3@2.7.0
2.8.0
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
python-urllib3@1.25.8-2ubuntu0.1
no fix listed
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
urllib3@2.6.3
2.8.0
1
quay.io/datamattsson/truenas-csp:v3.2.09e58f2127d85
urllib3@2.7.0
2.8.0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
urllib3@2.7.0
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
urllib3@2.7.0
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
urllib3@2.6.3
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
urllib3@2.6.3
2.8.0
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.10.021b9fe7bb29d
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.15bc0c5634d4a
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.3694950d736c8
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.6.0a6c101156d42
urllib3@2.6.3
2.8.0
1
quay.io/kubev2v/forklift-operator:release-2.1200312252b07e
urllib3@2.7.0
2.8.0
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
urllib3@2.7.0
2.8.0
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
urllib3@2.7.0
2.8.0
1
quay.io/maxiv/pieeat:0.9.3099715479210
urllib3@2.6.3
2.8.0
1
quay.io/opstree/k8s-sidecar:2.7.126aa9bb3386b
urllib3@2.6.3
2.8.0
1
quay.io/opstree/k8s-sidecar:2.7.37075d455b219
urllib3@2.7.0
2.8.0
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
urllib3@2.6.2
2.8.0
1
quay.io/stackgres/operator:1.19.282f33ab3fb1e
urllib3@2.7.0
2.8.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
1
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
urllib3@2.7.0
2.8.0
1
registry.gitlab.com/dyff/workflows-sink:0.16.4001e589acf2e
urllib3@2.6.3
2.8.0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
python-pip@20.0.2-5ubuntu1.1
no fix listed
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
urllib3@2.6.2
2.8.0
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.